Privacy Policy

Last updated: March 15, 2026

SkillQuest ("we", "us", or "our") provides a Shopify application that enables merchants to display gamified discount widgets on their storefront and optionally collect visitor email addresses for marketing purposes.

This Privacy Policy explains how we collect, use, disclose, and protect information when merchants install and use the SkillQuest Shopify application (the "Service").

By installing or using the Service, you agree to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Information from Shopify Merchants

When a merchant installs the Service, we may access and collect certain information from Shopify through the Shopify API, including:

Store name
Store domain
Store contact email address
Shopify plan information
App configuration settings created by the merchant
Discount settings and widget configuration
Limited order data used for revenue attribution

Shopify API Permissions

The Service requests the following Shopify API permissions (scopes) and uses them as described:

Permission	Purpose
`read_discounts` / `write_discounts`	Create and manage discount codes generated by the stopwatch game
`read_orders`	Track order data for revenue attribution and analytics reporting
`read_inventory`	Check product inventory status for discount eligibility
`read_locales`	Detect store locale for widget localization

We request only the minimum permissions necessary for the Service to function.

All billing and payment processing is handled by the Shopify Billing API. We do not collect or store payment card data.

1.2 Information from Store Visitors (End Users)

When a visitor interacts with the SkillQuest widget displayed on a merchant's storefront, we may collect the following information:

Game interaction data (start time, stop time, results)
Email address (only if voluntarily submitted by the visitor)
Browser type and device type
Screen size and display information
Page URL where the widget appears
Basic widget interaction analytics

Email addresses are collected only if the merchant enables the email collection feature and the visitor voluntarily submits their email address.

We do not collect personal identification information beyond the email address voluntarily submitted by the visitor.

We do not use cookies for cross-site tracking or behavioral advertising.

We may use first-party session identifiers or browser storage (such as local storage) to:

operate the game widget
prevent abuse of the game mechanics
ensure fair play

1.3 Third-Party Integrations

The Service may integrate with third-party email marketing platforms including:

Klaviyo
Mailchimp

If a merchant enables one of these integrations, email addresses collected through the widget may be transmitted directly to the configured platform on behalf of the merchant.

These services process data according to their own privacy policies.

We do not store third-party API credentials except encrypted tokens necessary to maintain the integration.

2. How We Use Information

We use collected information to:

provide and maintain the Service
display and operate the gamified widget
generate and manage discount codes
provide analytics and reporting to merchants
transmit collected email addresses to the merchant or configured marketing platform
improve the Service and its features
provide customer support

We may use aggregated and anonymized usage data to improve product performance and functionality.

For storefront widget interactions, we respect the visitor's analytics consent preference as reported by the Shopify Customer Privacy API. However, server-side events such as order data received through Shopify webhooks are processed independently of visitor consent, as this data originates from the merchant's Shopify store and is used for the merchant's own revenue attribution and reporting.

3. How Information Is Shared

We do not sell personal information.

Information may be shared only in the following circumstances.

With Merchants

Store visitor data (including email addresses if submitted) is shared with the merchant operating the storefront where the widget appears.

The merchant is responsible for how that information is used for marketing or communications.

With Third-Party Email Platforms

If configured by the merchant, email addresses may be transmitted to:

Klaviyo
Mailchimp

These platforms act as independent data processors and handle data according to their own privacy policies.

With Infrastructure Providers

We use Google Cloud Platform (located in the United States) to host and operate the Service. This includes:

Google Cloud Firestore — primary data storage for merchant configurations, widget settings, collected email addresses, and issued discount codes
Google BigQuery — aggregated analytics and reporting data
Google Cloud Run — application hosting

Google Cloud Platform processes data according to the Google Cloud Data Processing Addendum.

With Shopify

We may share data with Shopify when necessary to operate the application and comply with Shopify platform requirements.

Legal Requirements

We may disclose information if required by law, regulation, or legal process.

4. Merchant Responsibilities

Merchants using the Service are responsible for:

complying with applicable data protection laws
obtaining any required consent before collecting visitor email addresses
complying with email marketing laws such as GDPR, CAN-SPAM, and other local regulations

SkillQuest acts as a technology provider and processes personal data on behalf of the merchant.

5. Data Retention and Storage Location

Data is stored on Google Cloud Platform infrastructure located in the United States.

Merchant data is retained while the app remains installed.

When the app is uninstalled, session data is immediately revoked. All remaining merchant data (configurations, analytics, collected emails, issued codes) is deleted when Shopify issues the shop data erasure request, typically within 48 hours of uninstallation.

Analytics data retention may vary depending on the merchant's subscription plan.

Email addresses collected through the Service are stored on behalf of the merchant until:

exported by the merchant
deleted by the merchant
or the app is uninstalled and shop data erasure is processed

6. Data Security

We implement appropriate technical and organizational safeguards to protect data, including:

encrypted transmission using HTTPS
encryption of sensitive tokens
restricted access to production systems
secure infrastructure hosting

However, no method of internet transmission can be guaranteed to be completely secure.

7. GDPR and International Data Transfers

For users located in the European Economic Area (EEA), United Kingdom, or Switzerland:

The merchant operating the store acts as the data controller
SkillQuest acts as a data processor

Personal data may be processed based on:

legitimate interest (operating the Service)
consent (visitor email submission)

Visitors who wish to access, correct, or delete their personal data should contact the merchant whose store they interacted with.

Merchants may contact us for assistance with data requests.

Personal data may be transferred to countries outside the EEA where necessary to operate the Service. Appropriate safeguards are applied when required.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you may have the right to:

know what personal information we collect
request deletion of personal information
opt out of the sale of personal information

We do not sell personal information.

9. Children's Privacy

The Service is not directed to children under the age of 13 (or 16 in the EEA).

We do not knowingly collect personal information from children. If we learn that such information has been collected, we will delete it.

10. Shopify Platform Compliance

SkillQuest complies with the Shopify API Terms of Service and Shopify's data protection requirements.

We request only the Shopify API permissions necessary for the functionality of the Service.

11. Changes to This Policy

We may update this Privacy Policy periodically.

Material changes may be communicated through the app dashboard or via email.

12. Related Policies

13. Contact

If you have questions about this Privacy Policy or our data practices, contact:

support@stopwatchdiscount.com